Israeli company NSO hacks WhatsApp to spy on human rights defenders

One of Israel’s notorious companies, NSO, has been accused of hacking the phones of human rights lawyers, political activists and journalists, causing a security breach in popular messaging app WhatsApp, which is used by 1.5 billion people across the world. 

NSO sells most of its products, including its infamous software Pegasus, to several international clients, including the intelligence agencies of the Middle East’s autocratic states. The company justifies its sales by saying that products help governments track terrorist and criminal activity. 

But WhatsApp came out with scathing criticism of NSO. “This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” WhatsApp said in a press release. 

“We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society.”

NSO hacking through WhatsApp has outraged many from security analysts to human rights advocates, fuelling worldwide concerns about the safety of citizens’ private data. 

“The rumours unfortunately seem true. Whatsapp itself confirmed the existence of this vulnerability, and their effort to patch it up,” said Mohamdi Veten, an IT specialist based in Turkey's capital Ankara. 

“The spyware used a trusted and ubiquitous app for its mischief. In such cases, the apps, like WhatsApp, and operating systems developers, iOS or Android, are partly to blame for being surpassed or outwitted by such malicious actors,” Veten told TRT World. 

“Somehow journalists and human rights activists end up becoming the victims,” Veten added.  

This time, NSO targeted a British lawyer who has dealt with criminal cases against the company, and also allegedly hacked the phones of Saudi dissident Omar Abdulaziz, a group of Mexican journalists and a Qatari figure, according to WhatsApp engineers. 

Edward Snowden, the NSA whistleblower, also claimed recently that Saudi dissident Jamal Khashoggi was killed by Saudi state operatives using NSO hacking tools. Khashoggi was brutally killed in Riyadh’s Istanbul consulate last year. 

“It [NSO] gained popularity when it was the first company to hack through iPhone,” Veten recalled. 

NSO’s usefulness for states

For intelligence agencies, NSO’s hacking devices are cheap to obtain and easy to navigate. It's also known for not leaving any traces behind. 

Just as curtailing state-sponsored surveillance has become a daunting task, it has become equally hard to establish accountability from governments with questionable human rights records. 

“Attribution is very hard," Veten said. "You are familiar with the Russian meddling in the US election. Who would you blame? The Internet Research Agency [the Russian company, which was allegedly involved in the meddling] or the Kremlin?” 

“In cybersecurity the most difficult job after a cyberattack is to definitively name a perpetrator. This problem is called 'Attribution Problem'. Even if we reached NSO in this case, do you think NSO will tell us this was done on behalf of this [particular] government?”

According to legal experts, NSO has a purpose and that is to serve Israeli interests, since the company works under Israel's defense ministry.

“Israel has a very clear policy of targeting human rights activists and lawyers, who expose the true face of its racist and criminal regime,” said Hassan Ben Imran, a jurist and Director of One Justice, a Paris-based human rights group.

As recent WhatsApp revelations have indicated, NSO is intentionally going after human rights advocates and activists, who have particularly focused on uncovering the suppression tactics of Saudi Arabia and the UAE, Israel’s Gulf allies. 

“NSO Group sells its products to governments who are known for outrageous human rights abuses, giving them the tools to track activists and critics,” said Danna Ingleton, Deputy Director of Amnesty International Tech. 

NSO has also recently attacked Amnesty International in an attempt to hack a researcher’s phone. 

“Amnesty international is now trying to take legal action locally against the [Israeli] Ministry of Defense for hiring the NSO. This is a good step, but not enough,” Imran told TRT World. 

“[The] Israeli legal system isn’t impartial when it comes to Israel’s violations against Palestinians and pro-Palestinian activists. There have been many incidents when Israeli high court justified Israeli actions,” Imran concluded.